@nodii/telemetry 0.1.1 → 0.3.1

package/dist/drizzle/audit-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-schema.d.ts","sourceRoot":"","sources":["../../src/drizzle/audit-schema.ts"],"names":[],"mappings":"AAyCA,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,KAAK,SAAS,EACd,KAAK,YAAY,EAClB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAC;AAC7C,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;AAoBxC;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,QAQ9B,CAAC;AAET;;GAEG;AACH,eAAO,MAAM,sBAAsB,QAO3B,CAAC;AAET,6DAA6D;AAC7D,eAAO,MAAM,kBAAkB,qLAAgD,CAAC;AAEhF,0DAA0D;AAC1D,eAAO,MAAM,gBAAgB,kIAA0C,CAAC;AAExE;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,CAAC,IAAI,SAAS,MAAM,EAC3D,WAAW,EAAE,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoHlB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,CAAC,SAAS,UAAU,CAAC,OAAO,mBAAmB,CAAC,EAChD,KAAK,EAAE,CAAC,EAAE,YAAY,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;EA2B/B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAmDlE"}

package/dist/drizzle/audit-schema.js

@@ -0,0 +1,268 @@
+// `@nodii/telemetry/drizzle` — canonical `<service>_audit_event` Drizzle
+// schema fragment per `02-audit-doctrine.md § 3`.
+//
+// Each Nodii service owns its own `<service>_audit_event` table (e.g.
+// `billing_audit_event`, `inventory_audit_event`). The library ships
+// the schema FRAGMENT so every service runs the same migration shape.
+//
+// Usage:
+//
+//   import { makeAuditEventTable, auditEventIndexes,
+//            auditEventPartitionDDL } from "@nodii/telemetry/drizzle";
+//
+//   export const auditEvent = makeAuditEventTable("billing");
+//   export const auditEventIdx = auditEventIndexes(auditEvent, "billing");
+//
+// Notes:
+//   - Drizzle cannot declare `PARTITION BY RANGE (at)` natively. Services
+//     that want monthly partitioning (D32) must emit the table via the raw
+//     `auditEventPartitionDDL("billing")` instead of letting Drizzle's
+//     migration tool create it. The doctrine ships partitioning as a
+//     recommendation, not a hard requirement.
+//   - `actor_kind` and `outcome` use Postgres enums. The enum types are
+//     declared once per DB (`audit_actor_kind`, `audit_outcome`) — this
+//     module ships the literal DDL via `AUDIT_ACTOR_KIND_ENUM_DDL` +
+//     `AUDIT_OUTCOME_ENUM_DDL` so service migrations can run them once.
+import { bigint, customType, index, inet, integer, jsonb, pgEnum, pgTable, text, timestamp, uniqueIndex, uuid, } from "drizzle-orm/pg-core";
+import { sql } from "drizzle-orm";
+import { AUDIT_ACTOR_KINDS, AUDIT_OUTCOMES, } from "../audit-types";
+export { AUDIT_ACTOR_KINDS, AUDIT_OUTCOMES };
+/**
+ * `bytea` column for the audit-chain hash columns (`prev_hash`, `row_hash`).
+ * Drizzle 0.36 lacks a first-class `bytea` builder, so this defines one as a
+ * `customType`. Round-trips `Uint8Array` (or Node `Buffer`) through `node-pg`
+ * which serialises `bytea` as `Buffer`.
+ */
+const bytea = customType({
+    dataType() {
+        return "bytea";
+    },
+    toDriver(value) {
+        return Buffer.isBuffer(value) ? value : Buffer.from(value);
+    },
+    fromDriver(value) {
+        return new Uint8Array(value.buffer, value.byteOffset, value.byteLength);
+    },
+});
+/**
+ * `CREATE TYPE` DDL for the global `audit_actor_kind` enum. Run once per DB
+ * during service bootstrap before any `<svc>_audit_event` table is created.
+ * Wrapped in a `DO` block to be idempotent (Postgres lacks `CREATE TYPE IF
+ * NOT EXISTS`).
+ */
+export const AUDIT_ACTOR_KIND_ENUM_DDL = `
+DO $$ BEGIN
+  CREATE TYPE audit_actor_kind AS ENUM (
+    'employee_user','tenant_user','tenant_customer','service','worker',
+    'webhook_provider','external_system','agent','system','unknown'
+  );
+EXCEPTION WHEN duplicate_object THEN NULL;
+END $$;
+`.trim();
+/**
+ * `CREATE TYPE` DDL for the global `audit_outcome` enum. Run once per DB.
+ */
+export const AUDIT_OUTCOME_ENUM_DDL = `
+DO $$ BEGIN
+  CREATE TYPE audit_outcome AS ENUM (
+    'success','failure','partial','queued','dry_run','denied_by_authz','denied_by_mfa'
+  );
+EXCEPTION WHEN duplicate_object THEN NULL;
+END $$;
+`.trim();
+/** Drizzle handle for the shared `audit_actor_kind` enum. */
+export const auditActorKindEnum = pgEnum("audit_actor_kind", AUDIT_ACTOR_KINDS);
+/** Drizzle handle for the shared `audit_outcome` enum. */
+export const auditOutcomeEnum = pgEnum("audit_outcome", AUDIT_OUTCOMES);
+/**
+ * Build the canonical `<serviceName>_audit_event` Drizzle table per
+ * `02-audit-doctrine.md § 3`. Column order, types, and nullability match the
+ * doctrine 1:1. `tenant_id` FK is `ON DELETE RESTRICT` per § 3.1 — the
+ * tenants table is never row-deleted.
+ *
+ * Indexes (§ 3 lines 156-167) are declared inline via the pgTable extras
+ * callback so Drizzle owns column→index attachment. Consumers receive the
+ * canonical 8 indexes on the returned table; if a service wants additional
+ * service-specific indexes they layer them on top after this call.
+ */
+export function makeAuditEventTable(serviceName) {
+    const tableName = `${serviceName}_audit_event`;
+    return pgTable(tableName, {
+        id: uuid("id").primaryKey().default(sql `gen_random_uuid()`),
+        // Tenant + timing
+        tenantId: uuid("tenant_id").notNull(),
+        at: timestamp("at", { withTimezone: true }).notNull().default(sql `now()`),
+        // Actor (kind discriminator + dual-identity columns + structured stamp)
+        actorKind: auditActorKindEnum("actor_kind").notNull(),
+        actorId: text("actor_id"),
+        actorExternalId: text("actor_external_id"),
+        actorDisplay: text("actor_display"),
+        actorIp: inet("actor_ip"),
+        actorUserAgent: text("actor_user_agent"),
+        actor: jsonb("actor").$type(),
+        // What
+        action: text("action").notNull(),
+        resourceType: text("resource_type").notNull(),
+        resourceId: text("resource_id"),
+        resourceLabel: text("resource_label"),
+        secondaryResourceType: text("secondary_resource_type"),
+        secondaryResourceId: text("secondary_resource_id"),
+        // Outcome
+        outcome: auditOutcomeEnum("outcome").notNull().default("success"),
+        httpStatus: integer("http_status"),
+        grpcCode: text("grpc_code"),
+        errorCode: text("error_code"),
+        errorMessage: text("error_message"),
+        errorDetails: jsonb("error_details").$type(),
+        // State capture (§ 8)
+        before: jsonb("before").$type(),
+        after: jsonb("after").$type(),
+        patch: jsonb("patch").$type(),
+        changedFields: text("changed_fields").array(),
+        // Reason
+        reasonCode: text("reason_code"),
+        reasonText: text("reason_text"),
+        // Correlation
+        requestId: text("request_id"),
+        correlationId: text("correlation_id"),
+        traceId: text("trace_id"),
+        spanId: text("span_id"),
+        intentId: uuid("intent_id"),
+        sagaId: text("saga_id"),
+        stepId: text("step_id"),
+        idempotencyKey: text("idempotency_key"),
+        // Async context
+        queueName: text("queue_name"),
+        jobId: text("job_id"),
+        parentAuditEventId: uuid("parent_audit_event_id"),
+        // Read coalescing (§ 9)
+        readCount: integer("read_count"),
+        firstReadAt: timestamp("first_read_at", { withTimezone: true }),
+        lastReadAt: timestamp("last_read_at", { withTimezone: true }),
+        // Tamper evidence (§ 13 — opt-in via @nodii/audit-chain)
+        prevHash: bytea("prev_hash"),
+        rowHash: bytea("row_hash"),
+        tenantAuditSeq: bigint("tenant_audit_seq", { mode: "bigint" }),
+        // Extensible
+        metadata: jsonb("metadata")
+            .$type()
+            .notNull()
+            .default(sql `'{}'::jsonb`),
+    }, (t) => ({
+        tenantTime: index(`${serviceName}_audit_tenant_time`).on(t.tenantId, t.at),
+        resource: index(`${serviceName}_audit_resource`).on(t.tenantId, t.resourceType, t.resourceId, t.at),
+        actionOutcome: index(`${serviceName}_audit_action_outcome`).on(t.tenantId, t.action, t.outcome, t.at),
+        actor: index(`${serviceName}_audit_actor`).on(t.tenantId, t.actorId, t.at),
+        correlation: index(`${serviceName}_audit_correlation`).on(t.tenantId, t.correlationId),
+        trace: index(`${serviceName}_audit_trace`).on(t.tenantId, t.traceId),
+        saga: index(`${serviceName}_audit_saga`)
+            .on(t.tenantId, t.sagaId, t.at)
+            .where(sql `${t.sagaId} IS NOT NULL`),
+        tenantSeq: uniqueIndex(`${serviceName}_audit_tenant_seq`)
+            .on(t.tenantId, t.tenantAuditSeq)
+            .where(sql `${t.tenantAuditSeq} IS NOT NULL`),
+    }));
+}
+/**
+ * Re-exposes the canonical 8 indexes that `makeAuditEventTable` already
+ * declares inline. Useful for tests + tooling that want to introspect the
+ * named-index set without rebuilding the table.
+ *
+ * For runtime migration purposes you do NOT need to call this — Drizzle's
+ * own kit picks up the inline indexes when emitting CREATE INDEX statements.
+ */
+export function auditEventIndexes(table, _serviceName) {
+    // The table builder's third callback's return value is stored on the
+    // table's `_.extraConfig`/symbol fields per drizzle internals. The safer
+    // public approach is to look at the result of `getTableConfig`'s indexes.
+    // Re-deriving the names directly avoids depending on private symbols.
+    void table;
+    void _serviceName;
+    const names = [
+        `${_serviceName}_audit_tenant_time`,
+        `${_serviceName}_audit_resource`,
+        `${_serviceName}_audit_action_outcome`,
+        `${_serviceName}_audit_actor`,
+        `${_serviceName}_audit_correlation`,
+        `${_serviceName}_audit_trace`,
+        `${_serviceName}_audit_saga`,
+        `${_serviceName}_audit_tenant_seq`,
+    ];
+    return {
+        tenantTime: { name: names[0] },
+        resource: { name: names[1] },
+        actionOutcome: { name: names[2] },
+        actor: { name: names[3] },
+        correlation: { name: names[4] },
+        trace: { name: names[5] },
+        saga: { name: names[6] },
+        tenantSeq: { name: names[7] },
+    };
+}
+/**
+ * Raw `CREATE TABLE ... PARTITION BY RANGE (at)` DDL for services that want
+ * monthly range partitioning per D32 + § 3 line 169. Drizzle's declarative
+ * migration cannot emit `PARTITION BY` — services that adopt this must run
+ * this DDL directly via their migration runner BEFORE Drizzle's
+ * `migrate(...)` would otherwise create the table.
+ *
+ * After the partitioned parent table exists, the consumer migration scripts
+ * create monthly partition children (`<svc>_audit_event_2026_06` etc.) per
+ * their retention/operational cadence.
+ *
+ * Indexes from `auditEventIndexes` are still created against the parent
+ * table — Postgres propagates them to existing + future child partitions.
+ */
+export function auditEventPartitionDDL(serviceName) {
+    return `
+CREATE TABLE ${serviceName}_audit_event (
+  id                          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id                   UUID NOT NULL REFERENCES tenants(id) ON DELETE RESTRICT,
+  at                          TIMESTAMPTZ NOT NULL DEFAULT now(),
+  actor_kind                  audit_actor_kind NOT NULL,
+  actor_id                    TEXT,
+  actor_external_id           TEXT,
+  actor_display               TEXT,
+  actor_ip                    INET,
+  actor_user_agent            TEXT,
+  actor                       JSONB,
+  action                      TEXT NOT NULL,
+  resource_type               TEXT NOT NULL,
+  resource_id                 TEXT,
+  resource_label              TEXT,
+  secondary_resource_type     TEXT,
+  secondary_resource_id       TEXT,
+  outcome                     audit_outcome NOT NULL DEFAULT 'success',
+  http_status                 INTEGER,
+  grpc_code                   TEXT,
+  error_code                  TEXT,
+  error_message               TEXT,
+  error_details               JSONB,
+  before                      JSONB,
+  after                       JSONB,
+  patch                       JSONB,
+  changed_fields              TEXT[],
+  reason_code                 TEXT,
+  reason_text                 TEXT,
+  request_id                  TEXT,
+  correlation_id              TEXT,
+  trace_id                    TEXT,
+  span_id                     TEXT,
+  intent_id                   UUID,
+  saga_id                     TEXT,
+  step_id                     TEXT,
+  idempotency_key             TEXT,
+  queue_name                  TEXT,
+  job_id                      TEXT,
+  parent_audit_event_id       UUID REFERENCES ${serviceName}_audit_event(id),
+  read_count                  INTEGER,
+  first_read_at               TIMESTAMPTZ,
+  last_read_at                TIMESTAMPTZ,
+  prev_hash                   BYTEA,
+  row_hash                    BYTEA,
+  tenant_audit_seq            BIGINT,
+  metadata                    JSONB NOT NULL DEFAULT '{}'::jsonb
+) PARTITION BY RANGE (at);
+`.trim();
+}
+//# sourceMappingURL=audit-schema.js.map

package/dist/drizzle/audit-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-schema.js","sourceRoot":"","sources":["../../src/drizzle/audit-schema.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,kDAAkD;AAClD,EAAE;AACF,sEAAsE;AACtE,qEAAqE;AACrE,sEAAsE;AACtE,EAAE;AACF,SAAS;AACT,EAAE;AACF,qDAAqD;AACrD,uEAAuE;AACvE,EAAE;AACF,8DAA8D;AAC9D,2EAA2E;AAC3E,EAAE;AACF,SAAS;AACT,0EAA0E;AAC1E,2EAA2E;AAC3E,uEAAuE;AACvE,qEAAqE;AACrE,8CAA8C;AAC9C,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,wEAAwE;AAExE,OAAO,EACL,MAAM,EACN,UAAU,EACV,KAAK,EACL,IAAI,EACJ,OAAO,EACP,KAAK,EACL,MAAM,EACN,OAAO,EACP,IAAI,EACJ,SAAS,EACT,WAAW,EACX,IAAI,GACL,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EACL,iBAAiB,EACjB,cAAc,GAGf,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAC;AAG7C;;;;;GAKG;AACH,MAAM,KAAK,GAAG,UAAU,CAA2C;IACjE,QAAQ;QACN,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,QAAQ,CAAC,KAAK;QACZ,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC;IACD,UAAU,CAAC,KAAa;QACtB,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC1E,CAAC;CACF,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;;;;;;;;CAQxC,CAAC,IAAI,EAAE,CAAC;AAET;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;CAOrC,CAAC,IAAI,EAAE,CAAC;AAET,6DAA6D;AAC7D,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,CAAC;AAEhF,0DAA0D;AAC1D,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;AAExE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAAiB;IAEjB,MAAM,SAAS,GAAG,GAAG,WAAW,cAAuC,CAAC;IACxE,OAAO,OAAO,CACZ,SAAS,EACT;QACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,mBAAmB,CAAC;QAE3D,kBAAkB;QAClB,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;QACrC,EAAE,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,OAAO,CAAC;QAEzE,wEAAwE;QACxE,SAAS,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACrD,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC;QACzB,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC;QAC1C,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC;QACnC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC;QACzB,cAAc,EAAE,IAAI,CAAC,kBAAkB,CAAC;QACxC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAkC;QAE7D,OAAO;QACP,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;QAChC,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;QAC7C,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;QAC/B,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC;QACrC,qBAAqB,EAAE,IAAI,CAAC,yBAAyB,CAAC;QACtD,mBAAmB,EAAE,IAAI,CAAC,uBAAuB,CAAC;QAElD,UAAU;QACV,OAAO,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACjE,UAAU,EAAE,OAAO,CAAC,aAAa,CAAC;QAClC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;QAC3B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;QAC7B,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC;QACnC,YAAY,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC,KAAK,EAG/B;QAEX,sBAAsB;QACtB,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAkC;QAC/D,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAkC;QAC7D,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAkC;QAC7D,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,KAAK,EAAE;QAE7C,SAAS;QACT,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;QAC/B,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;QAE/B,cAAc;QACd,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;QAC7B,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC;QACrC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC;QACzB,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;QACvB,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;QAC3B,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;QACvB,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;QACvB,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC;QAEvC,gBAAgB;QAChB,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;QAC7B,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC;QACrB,kBAAkB,EAAE,IAAI,CAAC,uBAAuB,CAAC;QAEjD,wBAAwB;QACxB,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC;QAChC,WAAW,EAAE,SAAS,CAAC,eAAe,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QAC/D,UAAU,EAAE,SAAS,CAAC,cAAc,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QAE7D,yDAAyD;QACzD,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC;QAC5B,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC;QAC1B,cAAc,EAAE,MAAM,CAAC,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAE9D,aAAa;QACb,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC;aACxB,KAAK,EAA2B;aAChC,OAAO,EAAE;aACT,OAAO,CAAC,GAAG,CAAA,aAAa,CAAC;KAC7B,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACN,UAAU,EAAE,KAAK,CAAC,GAAG,WAAW,oBAAoB,CAAC,CAAC,EAAE,CACtD,CAAC,CAAC,QAAQ,EACV,CAAC,CAAC,EAAE,CACL;QACD,QAAQ,EAAE,KAAK,CAAC,GAAG,WAAW,iBAAiB,CAAC,CAAC,EAAE,CACjD,CAAC,CAAC,QAAQ,EACV,CAAC,CAAC,YAAY,EACd,CAAC,CAAC,UAAU,EACZ,CAAC,CAAC,EAAE,CACL;QACD,aAAa,EAAE,KAAK,CAAC,GAAG,WAAW,uBAAuB,CAAC,CAAC,EAAE,CAC5D,CAAC,CAAC,QAAQ,EACV,CAAC,CAAC,MAAM,EACR,CAAC,CAAC,OAAO,EACT,CAAC,CAAC,EAAE,CACL;QACD,KAAK,EAAE,KAAK,CAAC,GAAG,WAAW,cAAc,CAAC,CAAC,EAAE,CAC3C,CAAC,CAAC,QAAQ,EACV,CAAC,CAAC,OAAO,EACT,CAAC,CAAC,EAAE,CACL;QACD,WAAW,EAAE,KAAK,CAAC,GAAG,WAAW,oBAAoB,CAAC,CAAC,EAAE,CACvD,CAAC,CAAC,QAAQ,EACV,CAAC,CAAC,aAAa,CAChB;QACD,KAAK,EAAE,KAAK,CAAC,GAAG,WAAW,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC;QACpE,IAAI,EAAE,KAAK,CAAC,GAAG,WAAW,aAAa,CAAC;aACrC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC;aAC9B,KAAK,CAAC,GAAG,CAAA,GAAG,CAAC,CAAC,MAAM,cAAc,CAAC;QACtC,SAAS,EAAE,WAAW,CAAC,GAAG,WAAW,mBAAmB,CAAC;aACtD,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,cAAc,CAAC;aAChC,KAAK,CAAC,GAAG,CAAA,GAAG,CAAC,CAAC,cAAc,cAAc,CAAC;KAC/C,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAE/B,KAAQ,EAAE,YAAoB;IAC9B,qEAAqE;IACrE,yEAAyE;IACzE,0EAA0E;IAC1E,sEAAsE;IACtE,KAAK,KAAK,CAAC;IACX,KAAK,YAAY,CAAC;IAClB,MAAM,KAAK,GAAG;QACZ,GAAG,YAAY,oBAAoB;QACnC,GAAG,YAAY,iBAAiB;QAChC,GAAG,YAAY,uBAAuB;QACtC,GAAG,YAAY,cAAc;QAC7B,GAAG,YAAY,oBAAoB;QACnC,GAAG,YAAY,cAAc;QAC7B,GAAG,YAAY,aAAa;QAC5B,GAAG,YAAY,mBAAmB;KAC1B,CAAC;IACX,OAAO;QACL,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE;QAC9B,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE;QAC5B,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE;QACjC,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE;QACzB,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE;QAC/B,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE;QACzB,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE;QACxB,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE;KACrB,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CAAC,WAAmB;IACxD,OAAO;eACM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gDAuCsB,WAAW;;;;;;;;;CAS1D,CAAC,IAAI,EAAE,CAAC;AACT,CAAC"}

package/dist/drizzle/index.d.ts

@@ -0,0 +1,3 @@
+export { AUDIT_ACTOR_KINDS, AUDIT_ACTOR_KIND_ENUM_DDL, AUDIT_OUTCOMES, AUDIT_OUTCOME_ENUM_DDL, auditActorKindEnum, auditEventIndexes, auditEventPartitionDDL, auditOutcomeEnum, makeAuditEventTable, } from "./audit-schema";
+export type { ActorKind, AuditOutcome } from "./audit-schema";
+//# sourceMappingURL=index.d.ts.map

package/dist/drizzle/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/drizzle/index.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,cAAc,EACd,sBAAsB,EACtB,kBAAkB,EAClB,iBAAiB,EACjB,sBAAsB,EACtB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/drizzle/index.js

@@ -0,0 +1,5 @@
+// `@nodii/telemetry/drizzle` — Drizzle schema fragments for the
+// per-service audit_event table. Lives behind a subpath so consumers
+// who don't use Drizzle don't transitively pull `drizzle-orm`.
+export { AUDIT_ACTOR_KINDS, AUDIT_ACTOR_KIND_ENUM_DDL, AUDIT_OUTCOMES, AUDIT_OUTCOME_ENUM_DDL, auditActorKindEnum, auditEventIndexes, auditEventPartitionDDL, auditOutcomeEnum, makeAuditEventTable, } from "./audit-schema";
+//# sourceMappingURL=index.js.map

package/dist/drizzle/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/drizzle/index.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,qEAAqE;AACrE,+DAA+D;AAE/D,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,cAAc,EACd,sBAAsB,EACtB,kBAAkB,EAClB,iBAAiB,EACjB,sBAAsB,EACtB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,gBAAgB,CAAC"}

package/dist/index.d.ts

@@ -6,8 +6,11 @@ export { tracer, withSpanAttributes, getSagaTracer } from "./tracer";
 export type { Span, SpanKind, SpanRecord, SpanStatus } from "./tracer";
 export { metrics, MetricVocabularyError } from "./metrics";
 export type { CounterHandle, HistogramHandle, MetricRegistration, } from "./metrics";
-export { audit } from "./audit";
-export type { AuditEvent } from "./audit";
+export { _getAuditChain, _resetAuditChainForTests, _resetAuditWriterForTests, _setAuditChain, _setAuditWriter, audit, AUDIT_ACTOR_KINDS, AUDIT_OUTCOMES, } from "./audit";
+export type { ActorKind, ActorStamp, AuditArgs, AuditChainAdapter, AuditEvent, AuditEventRow, AuditOutcome, AuditWriter, } from "./audit";
+export { TelemetryAuditWriterMissing } from "./audit";
+export { configureTelemetry } from "./configure";
+export type { ConfigureTelemetryOptions } from "./configure";
 export { intent, IntentTypeNotRegistered } from "./intent";
 export { agentInvocable, readAgentRegistry, AGENT_INVOCABLE_METADATA, } from "./agent-invocable";
 export { getContext, requireContext, withContext, } from "./context";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EACL,UAAU,EACV,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACrE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACvE,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAC3D,YAAY,EACV,aAAa,EACb,eAAe,EACf,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAC3D,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,UAAU,EACV,cAAc,EACd,WAAW,GACZ,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAClD,YAAY,EACV,SAAS,EACT,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,EACzB,kBAAkB,EAClB,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,WAAW,EACX,QAAQ,EACR,YAAY,EACZ,qBAAqB,EACrB,wBAAwB,EACxB,YAAY,EACZ,kBAAkB,EAClB,cAAc,GACf,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,4BAA4B,GAC7B,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EACL,UAAU,EACV,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACrE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACvE,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAC3D,YAAY,EACV,aAAa,EACb,eAAe,EACf,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,yBAAyB,EACzB,cAAc,EACd,eAAe,EACf,KAAK,EACL,iBAAiB,EACjB,cAAc,GACf,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,SAAS,EACT,UAAU,EACV,SAAS,EACT,iBAAiB,EACjB,UAAU,EACV,aAAa,EACb,YAAY,EACZ,WAAW,GACZ,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,YAAY,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAC3D,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,UAAU,EACV,cAAc,EACd,WAAW,GACZ,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAClD,YAAY,EACV,SAAS,EACT,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,EACzB,kBAAkB,EAClB,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,WAAW,EACX,QAAQ,EACR,YAAY,EACZ,qBAAqB,EACrB,wBAAwB,EACxB,YAAY,EACZ,kBAAkB,EAClB,cAAc,GACf,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,4BAA4B,GAC7B,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -20,7 +20,9 @@ export { forceFlush, getOtlpAdapterHandle, installOtlpAdapter, shutdownOtlpAdapt
 export { logger } from "./logger";
 export { tracer, withSpanAttributes, getSagaTracer } from "./tracer";
 export { metrics, MetricVocabularyError } from "./metrics";
-export { audit } from "./audit";
+export { _getAuditChain, _resetAuditChainForTests, _resetAuditWriterForTests, _setAuditChain, _setAuditWriter, audit, AUDIT_ACTOR_KINDS, AUDIT_OUTCOMES, } from "./audit";
+export { TelemetryAuditWriterMissing } from "./audit";
+export { configureTelemetry } from "./configure";
 export { intent, IntentTypeNotRegistered } from "./intent";
 export { agentInvocable, readAgentRegistry, AGENT_INVOCABLE_METADATA, } from "./agent-invocable";
 export { getContext, requireContext, withContext, } from "./context";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,EAAE;AACF,0EAA0E;AAC1E,EAAE;AACF,wCAAwC;AACxC,2EAA2E;AAC3E,6EAA6E;AAC7E,+EAA+E;AAC/E,gEAAgE;AAChE,kEAAkE;AAClE,EAAE;AACF,oEAAoE;AACpE,gBAAgB;AAChB,EAAE;AACF,oEAAoE;AACpE,gEAAgE;AAChE,0DAA0D;AAE1D,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EACL,UAAU,EACV,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAErE,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAM3D,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAEhC,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAC3D,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,UAAU,EACV,cAAc,EACd,WAAW,GACZ,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAwBlD,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,4BAA4B,GAC7B,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,EAAE;AACF,0EAA0E;AAC1E,EAAE;AACF,wCAAwC;AACxC,2EAA2E;AAC3E,6EAA6E;AAC7E,+EAA+E;AAC/E,gEAAgE;AAChE,kEAAkE;AAClE,EAAE;AACF,oEAAoE;AACpE,gBAAgB;AAChB,EAAE;AACF,oEAAoE;AACpE,gEAAgE;AAChE,0DAA0D;AAE1D,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EACL,UAAU,EACV,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAErE,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAM3D,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,yBAAyB,EACzB,cAAc,EACd,eAAe,EACf,KAAK,EACL,iBAAiB,EACjB,cAAc,GACf,MAAM,SAAS,CAAC;AAWjB,OAAO,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAC3D,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,UAAU,EACV,cAAc,EACd,WAAW,GACZ,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAwBlD,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,4BAA4B,GAC7B,MAAM,SAAS,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nodii/telemetry",
-  "version": "0.1.1",
+  "version": "0.3.1",
   "description": "Substrate observability library for the Nodii microservice stack — OTel wrapper, log envelope, intent lifecycle, audit signal, agent registry, context propagation. Spec: planning hub docKey=telemetry.",
   "license": "MIT",
   "type": "module",
@@ -10,9 +10,15 @@
     ".": {
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
+    },
+    "./drizzle": {
+      "types": "./dist/drizzle/index.d.ts",
+      "default": "./dist/drizzle/index.js"
     }
   },
-  "files": ["dist"],
+  "files": [
+    "dist"
+  ],
   "publishConfig": {
     "access": "public"
   },
@@ -38,13 +44,22 @@
   },
   "peerDependencies": {
     "@opentelemetry/api": "^1.9.0",
-    "@opentelemetry/api-logs": "^0.57.2"
+    "@opentelemetry/api-logs": "^0.57.2",
+    "drizzle-orm": "^0.36.0"
   },
   "peerDependenciesMeta": {
-    "@opentelemetry/api": { "optional": true },
-    "@opentelemetry/api-logs": { "optional": true }
+    "@opentelemetry/api": {
+      "optional": true
+    },
+    "@opentelemetry/api-logs": {
+      "optional": true
+    },
+    "drizzle-orm": {
+      "optional": true
+    }
   },
   "devDependencies": {
+    "drizzle-orm": "^0.36.0",
     "typescript": "^5.9.3"
   },
   "repository": {